Network users (e.g., physical and/or logical network administrators) rely on event monitoring applications to identify and address potential network issues. An event monitoring application receives network events from different network elements (e.g., forwarding elements, applications, machines, etc.) and provides network data analysis based on the received events. As such, reducing downtime (e.g., during upgrade) for a log application has always been a priority. Any downtime (even a planned downtime) for an event monitoring system may carry considerable costs. Serious problems may arise when a single and important log (event) is generated and reported to a log application while the application is down. For a distributed log application that executes on a cluster of machines (e.g., virtual servers), event loss can be minimized by employing load balancing and failover techniques. Even using these techniques, however, does not guarantee that at a critical time during failover, one or more events are not lost. Additionally, clustering a log application presents its own challenges such as inter-node traffic security issues and management of the cluster's network topology.